Self-Hosting Ente Photos Behind a Cloudflare Tunnel: Preserving Request Integrity Through the Proxy Chain
Summary This is a complete account of standing up Ente — an end-to-end encrypted photo and video backup service — on a home server, exposed to the internet through a Cloudflare Tunnel, with mobile and web clients connecting to it from arbitrary networks. The straightforward part of this project was running docker compose up. The interesting part, and the reason this write-up exists, is a single architectural constraint that determines almost every other decision in the stack: Ente’s storage layer issues AWS SigV4 pre-signed URLs directly to the client, and pre-signed URL validation is byte-for-byte sensitive to header mutation along the request path. Any reverse proxy sitting between the client and the object store is a candidate for silently breaking uploads and downloads — and Cloudflare’s edge, which every hostname routed through a Cloudflare Tunnel passes through, is exactly this kind of proxy. ...